Show HN: Open-source compliance-as-code for crypto projects
So we hacked together a prototype framework that generates a “guardrail” smart contract which:
- Hooks into your KYC provider - Enforces rules defined a simple compliance.yaml file - Automatically blocks users you can't legally serve
When regulations shift (new blocked country, updated KYC threshold, etc.), just update your YAML and redeploy with no smart contract rewrites. Audit prep also becomes a breeze. Our goal is to make staying compliant as easy as possible
How it works:
1. Declare once in compliance.yaml modules: token_sale:
start_date: "2025-02-01" end_date: "2025-03-01" max_cap_usd: 500000 kyc_threshold_usd: 1000
geographic_restrictions: blocklist: ["US", "CN", "IR"]
2. Compile with one command shor compile --blockchain ethereum --with-oracle
This generates:
- Guardrail.sol – Smart contract that reverts non-compliant transactions - policy.pdf – Lawyer-readable compliance documentation - audit.json – Manifest with rules, timestamp, and bytecode hash
3. Deploy & forget - Drop Guardrail.sol into your existing deployment flow - Smart contract enforces rules automatically on-chain - Run shor export-audit --format=zip for auditors
Why now?
- Regulations are getting tighter and full, active compliance is becoming more necessary
Try it in either SDK or CLI: https://github.com/ShorPay/shor-compliance
We'd love your feedback on:
- Would this be useful for your projects? - How are you handling compliance today? - Which jurisdictions or rules give you the most trouble - Missing jurisdictions (we only have US/EU/SG) - KYC providers you need (we support Sumsub) - Smart contract patterns we should add
Email: founders@shorpay.com
Contributing: https://github.com/ShorPay/shor-compliance/blob/main/CONTRIB...
At this stage, I’d suggest actively joining a range of communities to gather feedback on how they might leverage this in their apps. A good starting point is the Base ecosystem[1], which lists projects with active Discords and Telegrams. You’ll find similar directories for Solana[2], Ethereum L2s, and other networks.
My main critique is around the compliance claims. Many jurisdictions, US included, lack clear guidance, and the landscape is changing quickly. There is a lot of gray area.
From a builder’s perspective, the key question is: What exactly does integrating this tool achieve in terms of regulatory compliance? Can they confidently rely on it as compliant? If so, where and how?
You might consider partnering with legal firms or compliance leaders who work directly with foundations and top-tier apps. Their input could help align your product with real-world needs and create a feedback loop that keeps the tool aligned with evolving guidance.
Finally, this seems like a massive lift to maintain. Curious how you plan to manage costs to keep it in sync over the next 3, 6, or 9 months—and how it sustains itself long-term.
Hope that helps!
[1] https://base.org/ecosystem [2] https://solapps.dev/